In the following speed table, smaller numbers are better. The numbers are interquartile means of single-core cycle counts on various microarchitectures. Overclocking is disabled.

The table reports cycle counts from lib25519 and, for comparison, OpenSSL and s2n-bignum. For comparability to OpenSSL's speed-testing utility, the OpenSSL cycle counts omit various OpenSSL overheads; see below for details. The s2n-bignum and lib25519 cycle counts include all overheads. There is also a lib25519+s2n line showing separate measurements of lib25519 after an optional pre-configuration ./use-s2n-bignum step (which is a supported option for lib25519); a lib25519+exp line showing separate measurements of lib25519 after an experimental pre-configuration mv skipcompilers/* compilers step (which is unsupported: it uses instructions not supported by valgrind); and a lib25519+s2n+exp line.

Microarchitectures are listed in reverse chronological order of when they were introduced. Each library is assigned one foreground color in the table.

In the lib25519 distribution, command/lib25519-speed.c measures lib25519; benchmarks/*-* is the output of lib25519-speed on various machines; speedcomparison/openssl/* has code to measure OpenSSL, and measurements from various machines; speedcomparison/s2n/* has code to measure s2n-bignum, and measurements from various machines; and autogen/md-speed extracts the table from those measurements. OpenSSL benchmarks use version 4.0.1 (2026.06.09); s2n-bignum benchmarks use commit fce78c7c17baee6a60511efe821930d4d049a6c0 (2026.06.12).

The table reports only interquartile means of cycle counts, not the full distribution of cycle counts. See the full output files for differences between multiple measurements and the interquartile mean. The table reports the following major operations:

• "X key": Generating an X25519 public key and secret key. This is dh_x25519_keypair selected 32 in the lib25519-speed output (lib25519_dh_keypair in the stable API).

  For s2n-bignum, this is x25519-keygen in the s2n25519speed output, measuring the cost of curve25519_x25519base_byte_alt, or curve25519_x25519base_byte on machines where that works and is faster.

  For OpenSSL, this is x25519-keygen-main in the openssl25519speed output, measuring the cost of EVP_PKEY_Q_keygen(0,0,"X25519"). This does not include small OpenSSL overheads for converting the public key and secret key to storage format.

• "X dh": Generating an X25519 shared secret. This is dh_x25519 selected 32 in the lib25519-speed output (lib25519_dh in the stable API).

  For s2n-bignum, this is x25519-dh in the s2n25519speed output, measuring the cost of curve25519_x25519_byte_alt, or curve25519_x25519_byte on machines where that works and is faster.

  For OpenSSL, this is x25519-dh-main in the openssl25519speed output, measuring the cost of EVP_PKEY_derive (as in OpenSSL's speed-testing utility). This does not include the cost of EVP_PKEY_new_raw_public_key to decode the public key (x25519-dh-pkdecode, 2868 cycles on Tiger Lake), EVP_PKEY_CTX_new and EVP_PKEY_derive_init and EVP_PKEY_derive_set_peer for initialization (together x25519-dh-init, 1914 cycles on Tiger Lake), and EVP_PKEY_new_raw_private_key to decode the secret key if it is not decoded already (x25519-dh-skdecode, 113904 cycles on Tiger Lake).

• "X batch": Cost per secret of generating 16 separate shared secrets. This is nPbatch_montgomery25519 selected 16 in the lib25519-speed output divided by 16.

• "Ed key": Generating an Ed25519 public key and secret key. This is sign_ed25519_keypair selected 32 in the lib25519-speed output (lib25519_sign_keypair in the stable API).

  For OpenSSL, this is ed25519-keygen-main in the openssl25519speed output, measuring the cost of EVP_PKEY_Q_keygen(0,0,"ED25519"). This does not include small OpenSSL overheads for converting the public key and secret key to storage format.

• "Ed sign": Generating an Ed25519 signature of a 59-byte message. This is sign_ed25519 selected 59 in the lib25519-speed output (lib25519_sign in the stable API).

  For OpenSSL, this is ed25519-sign-main in the openssl25519speed output, measuring the cost of EVP_DigestSign (as in OpenSSL's speed-testing utility). This does not include the cost of EVP_MD_CTX_new and EVP_DigestSignInit (ed25519-sign-init, 2662 cycles on Tiger Lake), and EVP_PKEY_new_raw_private_key to decode the secret key if it is not decoded already (ed25519-sign-skdecode, 116227 cycles on Tiger Lake).

• "Ed verif": Verifying an Ed25519 signature and recovering a 59-byte message. This is sign_ed25519_open selected 59 in the lib25519-speed output (lib25519_sign_open in the stable API).

  For OpenSSL, this is ed25519-verify-main in the openssl25519speed output, measuring the cost of EVP_DigestVerify (as in OpenSSL's speed-testing utility). This does not include the cost of EVP_MD_CTX_new and EVP_DigestVerifyInit (together ed25519-verify-init, 2234 cycles on Tiger Lake), and EVP_PKEY_new_raw_public_key to decode the public key being used for verification (ed25519-verify-pkdecode, 3102 cycles on Tiger Lake).

• "Ed MSM": Cost per point of multi-scalar multiplication with 16 points and 16 full-size scalars. This is multiscalar_ed25519 selected 16 in the lib25519-speed output divided by 16.